Legal
Privacy Policy
In short
- Notulen AI records and transcribes meetings to write minutes and action items. A recording holds the voice and words of everyone in the meeting, not only the person who added it.
- Your organisation decides what is recorded and who can see it. We process meeting content on its behalf.
- We do not sell personal data, show advertising, use tracking cookies, or use your meetings to train AI models.
- Audio and transcripts go to the AI providers listed in Who processes data for us, some of them outside Indonesia.
- You can ask for a copy of your data, a correction, or deletion. See Your rights.
1. Who we are
Notulen AI (“the service”) is run by the operator of this service (“we”, “us”). This policy explains how we handle personal data in the Notulen AI web app, its meeting bot, its API and integrations, and this website.
Questions about this policy or your data: the contact form on our home page, or Help › Contact support in the app.
2. Our role and your organisation’s
Notulen AI is used by organisations — companies and teams that hold an account with us. Law No. 27 of 2022 on Personal Data Protection (“the PDP Law”) gives us a different role depending on the data:
- Meeting content belongs to the organisation that added it. That covers recordings, transcripts, minutes, action items, questions asked about meetings and their answers, recap images, and the calendar events used to send the bot. For this content the organisation is the controller and we are its processor: we handle it only to provide the service to that organisation, as it instructs us through the app and its agreement with us.
- Account and service data is ours to look after. That covers your sign-in details and devices, billing details, support requests, messages sent through our website, and security logs. For this data we are the controller.
If your question is about meeting content — for example, a meeting you were recorded in — the organisation that recorded it is the first place to ask. If you ask us, we pass the request on and help the organisation answer it.
3. What we collect
Your account
Name, email address, organisation, and role. Your password is never stored, only a salted scrypt hash of it. For passkeys we keep the public key; secrets for two-step verification and connected services are stored encrypted. If your organisation signs you in with its mail server, single sign-on, or Google, we receive your name and email address from it; a mailbox password is checked with your organisation’s mail server and never stored.
Devices and sessions
For each signed-in session: IP address, browser, operating system, device type, and when it was last used. We use this to show you your devices, let you sign out ones you have lost, and spot sign-ins that look unusual.
Meeting content
Audio from an uploaded file, a recording made in the browser, or the meeting bot; the transcript with speaker labels and timings; minutes, action items (task, owner, due date), recap images, and version history; and what people type about the meeting — title, agenda, participants, tags, speaker names, questions asked about it and the answers.
Meetings can contain sensitive information, such as health, financial details or personal views. Notulen AI does not look for it or treat it differently. Your organisation decides what is recorded.
The meeting bot
When someone in your organisation sends the bot to a Microsoft Teams, Google Meet or Zoom meeting, it joins as a participant under a name your organisation chooses and records the meeting audio. While it is there it notes the display names shown in the meeting and who was speaking when, to suggest speaker names afterwards. It does not read the meeting chat. It tries to post a message in the chat saying it is recording; whether that message appears depends on the meeting’s settings.
Speaker labels only tell the voices in one recording apart. We do not create or keep voiceprints, and we do not use voices to identify people across meetings.
Calendars
Only if you or your organisation connect one: event titles and times, the organiser, attendees’ names and email addresses, meeting links, location, and your response, so the bot can join the meetings you choose. Each person can opt out of being read through an organisation-wide connection.
Billing
Legal name, tax ID (NPWP), billing address, billing email, contact name and phone number, invoices, plan, and usage such as minutes of audio processed. We do not take card payments in the app.
Support and enquiries
What you write to us in the app or through the form on our website: name, email address, company, team size, and your message. The website form does not store your IP address.
Integrations your organisation turns on
Webhook addresses, Slack and Jira connection details, and API keys (stored only as a hash). These send meeting information to destinations your organisation chooses.
Logs
An activity log of actions in each organisation (who did what, when, and from which IP address), technical error reports, and web server logs (IP address, the address requested, and the browser).
4. If you were in a recorded meeting
You may be in a recording without having a Notulen AI account. The organisation that recorded the meeting decides why it records, who can read the result, and how long it is kept — and it must tell participants and get their consent where the law requires it. You can:
- ask the meeting host to remove the bot, or not to record;
- ask the organisation that recorded the meeting for a copy, a correction, or deletion;
- write to us at the contact form on our home page, or Help › Contact support in the app. We will pass your request to that organisation and help it respond.
5. How we use it
- To provide the service: record, transcribe, write minutes and action items, answer questions about meetings, draw recap cards, send the bot to meetings, read connected calendars, and send notifications and emails.
- To keep it secure: protect sign-ins, detect unusual activity, keep activity logs, and limit abuse.
- To bill: invoice organisations and apply plan limits.
- To help you: answer support requests and enquiries.
- To fix and improve the service: from technical error reports and counts such as how many meetings were processed, how long they were, and how many failed — not by reading your meetings.
- To meet legal obligations, such as keeping tax records.
Our legal bases under the PDP Law are the agreement with your organisation, our legitimate interest in running a secure and reliable service, legal obligations, and your consent where we ask for it — for example when you turn on push notifications or connect a personal calendar. You can withdraw consent at any time; it does not affect what was done before.
We do not sell personal data, show advertising, or use third-party analytics or trackers. We do not use your content to train AI models, and we have not agreed to any AI provider using it to train theirs.
6. AI and its limits
Transcripts, minutes, action items, answers, recap cards and speaker-name suggestions are produced by AI models and can be wrong. People in your organisation review and edit them; suggested speaker names are applied only after someone saves them. Notulen AI does not make decisions about you that have legal or similarly significant effects.
7. Who can see your data
- People in your organisation, according to their role, what is shared with them, and the meeting visibility set in your organisation’s agreement.
- Anyone with a public link, if someone in your organisation creates one. A link can require an access code, it stops working the moment it is revoked, and an organisation can switch public links off.
- Integrations your organisation connects — webhooks, Slack, Jira, API keys and AI assistants using the API — receive what they are set up to receive.
- Our support team, only when your organisation’s owner allows support access or asks for help. Every visit is recorded in your organisation’s activity log.
- The providers in the next section, only for the parts of the service listed there.
- Authorities, when the law requires it, and only what is required.
- A new owner of the service, if the service is sold or merged. This policy would continue to apply, and we would tell organisations first.
8. Who processes data for us
These companies process personal data on our behalf, only to provide the part of the service listed. The table is produced from this server’s current setup when you open this page, so it shows what is connected now.
| Provider | What for | Data | Where |
|---|---|---|---|
| Google Cloud | Runs the service: servers, database, recordings and backups | Everything described in this policy | Jakarta, Indonesia |
| Microsoft Azure AI Speech (MAI-Transcribe) | Speech-to-text: turns meeting audio into a transcript | Meeting audio | Singapore |
| Google Cloud Speech-to-Text | Speech-to-text, only if the platform team switches to it | Meeting audio, held briefly in Cloud Storage | United States |
| Google Cloud Vertex AI (Gemini) | Speech-to-text, only if the platform team switches to it | Meeting audio, held briefly in Cloud Storage | Not fixed: Google picks the region for each request |
| Google Cloud Vertex AI (Gemini) | Writes the minutes and action items, answers questions about meetings (Ask), suggests speaker names | Transcripts, and what people type about a meeting: title, agenda, participants, questions | Not fixed: Google picks the region for each request |
| Google Cloud Vertex AI (Gemini image model) | Draws the visual recap cards | A short summary of the minutes | Not fixed: Google picks the region for each request |
| Your browser’s push service (Google, Apple or Mozilla) | Delivers notifications, only to devices where you turn them on | An encrypted notification it cannot read, and the address your browser gave for the device | Chosen by your browser’s maker |
The meeting bot runs on our own servers unless a meeting-bot provider is listed above. Services that your organisation connects itself — its calendar, mail server, single sign-on, Slack, Jira, or webhook destinations — are not our processors: data goes there because your organisation chose it.
9. Transfers outside Indonesia
Our servers, database and backups are in Jakarta, Indonesia. Some providers above process data elsewhere — for example in Singapore or the United States — or in a region they pick for each request. When personal data leaves Indonesia, we rely on the data protection commitments in those providers’ business and data processing terms, as Article 56 of the PDP Law allows.
10. How long we keep data
| Data | How long |
|---|---|
| Recordings (audio) | 30 days after the meeting is added, unless your organisation sets its own period |
| Transcripts, and answers that quote them | Until deleted, unless your organisation sets its own period |
| Meetings, minutes and action items | Until deleted, unless your organisation sets its own period |
| Deleted meetings | 30 days in Trash, then removed for good |
| Activity log and in-app notifications | 180 days, unless your organisation sets its own period for the log |
| Sign-in sessions | Until you sign out or the session expires (30 days); devices not seen for 180 days are forgotten |
| Calendar events | Removed 48 hours after the event ends; a calendar connection lasts until you disconnect it |
| Technical error reports | 30 days |
| Your account | Until you delete it or the organisation closes. An account an admin switches off keeps your name and email address until then |
| A closed organisation | Read-only at once, then deleted with everything in it after 7 days |
| Invoices and billing records | As long as Indonesian tax law requires us to keep them |
| Support requests and messages sent from our website | Until we delete them; ask us at any time |
| Database backups (everything above except recordings) | 30 days |
| Daily copies of the server disk (including recordings) | 7 days |
An organisation sets its own periods under Administration › Organization › Data retention, and can place a legal hold, which stops deletion until it is released. When something is deleted it leaves the service at once, or at the next daily clean-up, and leaves backups when they expire.
11. Security
- Every connection uses HTTPS, and pages carry strict security headers.
- Passwords are stored as
scrypthashes; stored secrets are encrypted with AES-256-GCM. - Two-step verification, passkeys, single sign-on, session limits and network allow-lists are available to every person or organisation, depending on the plan.
- Access follows roles and sharing. Support access is controlled by each organisation’s owner and logged.
- Servers run in Google Cloud data centres in Jakarta, Indonesia. They accept no remote logins from the internet; administrators reach them through Google’s Identity-Aware Proxy.
No system is perfectly secure. If a breach affects personal data we hold, we will tell the organisations affected without undue delay. For data we control, we will also tell the people affected and the authority within 3 × 24 hours, as the PDP Law requires.
12. Cookies and browser storage
We use only cookies the service needs to work, and no advertising or analytics cookies:
| Cookie | What it does |
|---|---|
ant_sid | Keeps you signed in |
ant_dev | Recognises your browser, for your device list and remembered two-step verification |
ant_mfa, ant_sso, ant_ssoc, ant_wa, ant_cal | Short-lived: hold a sign-in, a passkey check, or a calendar connection while it is in progress |
ant_as | Marks a support session, when our support team is helping your organisation |
The app also keeps a few things in your browser: your theme and similar choices, its own code so it opens without a connection, and — while you record in the browser — the recording itself, so it survives a closed tab until it uploads. That copy is deleted once the upload finishes or you discard it. Fonts and scripts are served from our own server.
13. Your rights
Under the PDP Law you can be informed about how your data is processed; get access to it and a copy; have it corrected; have it deleted; withdraw consent; object to processing and to decisions made only by automated means; ask us to restrict or pause processing; receive your data in a format other systems can read; and complain or claim compensation.
- In the app: change your name under Account, and delete your account under Account › Delete your account. An organisation’s owner can download all of its data — including recordings — and close the organisation.
- For meeting content: ask your organisation’s admin, or write to us and we will pass it on.
- Anything else: write to the contact form on our home page, or Help › Contact support in the app. We may need to confirm who you are. We answer within the time limits set by the PDP Law — for most requests, 3 × 24 hours from when we receive them.
If you are not satisfied with our answer, you can complain to the authority responsible for personal data protection in Indonesia.
14. Children
Notulen AI is a work tool for organisations and is not meant for children. We do not knowingly collect children’s personal data. An organisation that records meetings where children take part is responsible for having the consent the law requires.
15. Changes to this policy
We will post any change on this page with a new effective date. If a change matters to how your data is used, we will tell organisation owners in the app or by email before it takes effect.
16. Contact
the operator of this service — the contact form on our home page, or Help › Contact support in the app.